## Notice :new: Changes to the default CI/CD template have been released in GitLab %15.4. :warning: If you are facing an immediate problem as a result of this change, see the [Workaround](#workaround) below. Please [contact GitLab Support](https://about.gitlab.com/support/) if you are a customer seeking time-sensitive assistance. :new: Early access to Semgrep-based scanning was made available in 15.0. We added [documentation](https://docs.gitlab.com/ee/user/application_security/sast/analyzers.html#transition-to-semgrep-based-scanning), including considerations for why you might want to [activate Semgrep-based scanning early](https://docs.gitlab.com/ee/user/application_security/sast/analyzers.html#activating-semgrep-based-scanning-early), in %15.0. We expanded instructions for [previewing CI/CD template changes](https://docs.gitlab.com/ee/user/application_security/sast/analyzers.html#preview-semgrep-based-scanning) in %15.3. Please comment on this issue if you have questions or feedback. ### Deprecation Summary GitLab SAST uses various [analyzers](https://docs.gitlab.com/ee/user/application_security/sast/analyzers/) to scan code for vulnerabilities. We are reducing the number of analyzers used in GitLab SAST as part of our long-term strategy to deliver a better and more consistent user experience. Streamlining the set of analyzers will also enable faster [iteration](https://about.gitlab.com/handbook/values/#iteration), better [results](https://about.gitlab.com/handbook/values/#results), and greater [efficiency](https://about.gitlab.com/handbook/values/#efficiency) (including a reduction in CI runner usage in most cases). In GitLab %15.4, GitLab SAST will no longer use the following analyzers by default: - [ESLint](https://gitlab.com/gitlab-org/security-products/analyzers/eslint) (JavaScript, TypeScript, React) - [Gosec](https://gitlab.com/gitlab-org/security-products/analyzers/gosec) (Go) - [Bandit](https://gitlab.com/gitlab-org/security-products/analyzers/bandit) (Python) These analyzers will be removed from the [GitLab-managed SAST CI/CD template](https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/gitlab/ci/templates/Security/SAST.gitlab-ci.yml) and replaced with the [Semgrep-based analyzer](https://gitlab.com/gitlab-org/security-products/analyzers/semgrep). Because they have been deprecated since %14.8, they may no longer receive routine updates, except for security issues. We will not delete container images previously published for these analyzers; any such change would be announced as a [deprecation, removal, or breaking change announcement](https://about.gitlab.com/handbook/marketing/blog/release-posts/#deprecations-removals-and-breaking-changes). We will also remove Java from the scope of the [SpotBugs](https://gitlab.com/gitlab-org/security-products/analyzers/spotbugs) analyzer and replace it with the [Semgrep-based analyzer](https://gitlab.com/gitlab-org/security-products/analyzers/semgrep). This change will make it simpler to scan Java code; compilation will no longer be required. This change will be reflected in the automatic language detection portion of the [GitLab-managed SAST CI/CD template](https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/gitlab/ci/templates/Security/SAST.gitlab-ci.yml). Note that the SpotBugs-based analyzer will continue to cover Groovy, Kotlin, and Scala. If you've already dismissed a vulnerability finding from one of the deprecated analyzers, the replacement attempts to respect your previous dismissal. The system behavior depends on: - whether you’ve excluded the Semgrep-based analyzer from running in the past. - which analyzer first discovered the vulnerabilities shown in the project’s Vulnerability Report. See [Vulnerability translation documentation](https://docs.gitlab.com/ee/user/application_security/sast/analyzers.html#vulnerability-translation) for further details. If you applied customizations to any of the affected analyzers or if you disabled the Semgrep-based analyzer, you must take action as detailed below. ### Actions Required You only need to take action if: 1. You applied customizations to one of the affected analyzers, such as setting a variable like `SAST_EXCLUDED_ANALYZERS` specifically on a job like `eslint-sast`, **and** that customization still applies to Semgrep. - You should migrate any option that is still needed to the `semgrep-sast` job. - Note that the `semgrep-sast` job itself handles multiple languages. Some of your previous customizations, especially those related to build or compilation processes, may no longer be neccessary or may not apply to all languages covered by the Semgrep analyzer. 1. You [customized a built-in rule](https://docs.gitlab.com/ee/user/application_security/sast/customize_rulesets.html#override-predefined-analyzer-rules) from one of the affected analyzers and still need the customization in Semgrep. - You should update the customization to refer to the rule's new identifier in this case. 1. You have explicitly disabled the Semgrep-based analyzer. - You should re-enable the Semgrep-based analyzer in this case. 1. You use the GitLab-managed CI/CD template and your pipeline configuration explicitly depends on a job name like `bandit-sast` or `spotbugs-sast`. - You should change your pipeline to refer to `semgrep-sast` or otherwise update it, depending on your use case. ### Workaround If you are experiencing a pipeline failure or invalid pipeline YAML, you can temporarily revert to an older version of the CI/CD template. Use a version before 15.4. As of this writing, the most recent 15.3 release is `v15.3.3-ee`. For details, see the new documentation topic [Troubleshooting pipeline errors related to changes in the GitLab-managed CI/CD template](https://docs.gitlab.com/ee/user/application_security/sast/index.html#pipeline-errors-related-to-changes-in-the-gitlab-managed-cicd-template). ### Affected Topology All deployment types (~SaaS and ~"self-managed") are affected. ### Affected Tier All tiers (~"GitLab Free", ~"GitLab Premium", ~"GitLab Ultimate") are affected. ### Checklist <details> - [x] mention your stage's stable counterparts on this issue. For example, Customer Support, Customer Success (Technical Account Manager), Product Marketing Manager. - To see who the stable counterparts are for a product team visit [product categories](https://about.gitlab.com/handbook/product/categories/) - If there is no stable counterpart listed for Sales/CS please mention `@timtams` - If there is no stable counterpart listed for Support please mention `@gitlab-com/support/managers` - If there is no stable counterpart listed for Marketing please mention `@cfoster3` - [x] mention your GPM so that they are aware of planned deprecations. The goal is to have reviews happen at least two releases before the final removal of the feature or introduction of a breaking change. - Customer Success stable counterparts: @bmiller1, @brianwald, @chloe - Support stable counterpart: @greg - Marketing stable counterpart: @cblake2000 - Director, Product Management: @hbenson _Note:_ Required and optional reviewers were already @-mentioned on the Deprecation MR (https://gitlab.com/gitlab-org/gitlab/-/merge_requests/80472). </details> ### Deprecation Milestone %14.8 ### Planned Removal Milestone %15.4 ### Links <!-- Add links to any relevant documentation or code that will provide additional details or clarity regarding the planned change. This issue is the main SSOT for the deprecations and removals process. Be sure to link all issues and MRs related to this deprecation/removal to this issue. This can include removal issues that were created ahead of time, and the MRs doing the actual deprecation/removal work. --> <!-- Label reminders - you should have one of each of the following labels. Use the following resources to find the appropriate labels: - https://gitlab.com/gitlab-org/gitlab/-/labels - https://about.gitlab.com/handbook/product/categories/features/ --> <!-- Populate the Section, Group, and Category --> <!-- Choose the Pricing Tier(s) --> <!-- Identifies that this Issue is related to deprecating a feature --> <!-- Add the ~"breaking change" label to this issue if necessary --> - https://gitlab.com/gitlab-org/gitlab/-/issues/350935+ - https://gitlab.com/gitlab-org/gitlab/-/issues/352666+ Deprecation Announcement: - Documentation: https://docs.gitlab.com/ee/update/deprecations#sast-analyzer-consolidation-and-cicd-template-changes - MR: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/80472+ Documentation topic: [Transition to Semgrep-based scanning](https://docs.gitlab.com/ee/user/application_security/sast/analyzers.html#transition-to-semgrep-based-scanning)